CVE-2023-26484
📋 TL;DR
This vulnerability in KubeVirt allows a compromised Kubernetes node to use the virt-handler service account to modify other node specifications, potentially leading to cluster-wide privilege escalation. Attackers could lure privileged components to their node to read secrets or execute commands on other pods. All KubeVirt deployments up to version 0.59.0 are affected.
💻 Affected Systems
- KubeVirt
📦 What is this software?
Kubevirt by Kubevirt
⚠️ Risk & Real-World Impact
Worst Case
Full privileged access to entire Kubernetes cluster, allowing reading all secrets, executing commands on any pod, and complete cluster compromise.
Likely Case
Privilege escalation from node-level access to cluster-wide access, enabling secret exfiltration and lateral movement across nodes.
If Mitigated
Limited to node-level compromise without ability to affect other nodes or escalate cluster privileges.
🎯 Exploit Status
Requires initial node compromise, but exploitation steps are straightforward once node access is obtained. Attack pattern involves modifying node specs to lure privileged components.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://github.com/kubevirt/kubevirt/security/advisories/GHSA-cp96-jpmq-xrr2
Restart Required: No
Instructions:
No official patch available. Monitor KubeVirt releases for fix. Current workaround involves using Gatekeeper webhooks.
🔧 Temporary Workarounds
Gatekeeper Webhook Restriction
linuxImplement Gatekeeper webhook to block virt-handler service account from modifying node specifications
kubectl apply -f gatekeeper-constraint.yaml
🧯 If You Can't Patch
- Implement strict network segmentation between nodes to limit lateral movement
- Enforce least privilege access controls and regularly audit service account permissions
🔍 How to Verify
Check if Vulnerable:
Check KubeVirt version: kubectl get deployments -n kubevirt -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'Check Version:
kubectl get deployments -n kubevirt -o jsonpath='{.items[*].spec.template.spec.containers[*].image}' | grep -o 'kubevirt/virt-handler:[^,]*'Verify Fix Applied:
Verify Gatekeeper constraints are applied: kubectl get constraints📡 Detection & Monitoring
Log Indicators:
- Unauthorized node spec modifications by virt-handler service account
- Unexpected node taint or label changes
- Privileged pods scheduled on compromised nodes
Network Indicators:
- Unusual API calls to modify node objects
- Increased traffic from compromised nodes to Kubernetes API
SIEM Query:
kubernetes.service_account:"virt-handler" AND kubernetes.verb:"update" AND kubernetes.resource:"nodes"